values.yaml

## NOTICE
#
# Due to the scope and complexity of this chart, all possible values are
# not documented in this file. Extensive documentation is available.
#
# Please read the docs: https://docs.gitlab.com/charts/
#
# Because properties are regularly added, updated, or relocated, it is
# _strongly suggest_ to not "copy and paste" this YAML. Please provide
# Helm only those properties you need, and allow the defaults to be
# provided by the version of this chart at the time of deployment.

## Advanced Configuration
## https://docs.gitlab.com/charts/advanced
#
# Documentation for advanced configuration, such as
# - External PostgreSQL
# - External Gitaly
# - External Redis
# - External NGINX
# - External Object Storage providers
# - PersistentVolume configuration

## The global properties are used to configure multiple charts at once.
## https://docs.gitlab.com/charts/charts/globals
global:
  common:
    labels: {}
  ## GitLab operator is DEPRECATED. DO NOT USE.
  operator:
    enabled: false
    rollout:
      autoPause: true

  ## Supplemental Pod labels. Will not be used for selectors.
  pod:
    labels: {}

  ## https://docs.gitlab.com/charts/installation/deployment#deploy-the-community-edition
  edition: ee

  ## https://docs.gitlab.com/charts/charts/globals#gitlab-version
  # gitlabVersion: master

  ## https://docs.gitlab.com/charts/charts/globals#application-resource
  application:
    create: false
    links: []
    allowClusterRoles: true
  ## https://docs.gitlab.com/charts/charts/globals#configure-host-settings
  hosts:
    domain: bigbang.dev
    hostSuffix:
    https: true
    externalIP:
    ssh: ~
    gitlab:
      name: gitlab.bigbang.dev
    minio: {}
    registry:
      name: registry.bigbang.dev
    tls: {}
    smartcard: {}
    kas: {}
    pages: {}

  ## https://docs.gitlab.com/charts/charts/globals#configure-ingress-settings
  ingress:
    configureCertmanager: false
    annotations: {}
    enabled: false
    tls: {}
    #   enabled: true
    #   secretName:
    path: /
    pathType: Prefix

  gitlab:
    ## Enterprise license for this GitLab installation
    ## Secret created according to https://docs.gitlab.com/charts/installation/secrets#initial-enterprise-license
    ## If allowing shared-secrets generation, this is OPTIONAL.
    license: {}
      # secret: RELEASE-gitlab-license
      # key: license

  ## Initial root password for this GitLab installation
  ## Secret created according to https://docs.gitlab.com/charts/installation/secrets#initial-root-password
  ## If allowing shared-secrets generation, this is OPTIONAL.
  initialRootPassword: {}
    # secret: RELEASE-gitlab-initial-root-password
    # key: password

  ## https://docs.gitlab.com/charts/charts/globals#configure-postgresql-settings
  psql:
    connectTimeout:
    password: {}
      # useSecret:
      # secret:
      # key:
      # file:
    # host: postgresql.hostedsomewhere.else
    # port: 123
    # username: gitlab
    # database: gitlabhq_production
    # applicationName:
    # preparedStatements: false

  ## https://docs.gitlab.com/charts/charts/globals#configure-redis-settings
  redis:
    password:
      enabled: true
      # secret:
      # key:
    # host: redis.hostedsomewhere.else
    # port: 6379
    # sentinels:
    #   - host:
    #     port:

  ## https://docs.gitlab.com/charts/charts/globals#configure-gitaly-settings
  gitaly:
    enabled: true
    authToken: {}
      # secret:
      # key:
    # serviceName:
    internal:
      names: ['default']
    external: []
    service:
      name: gitaly
      type: ClusterIP
      externalPort: 8075
      internalPort: 8075
      tls:
        externalPort: 8076
        internalPort: 8076
    tls:
      enabled: false
      # secretName:

  praefect:
    enabled: false
    replaceInternalGitaly: true
    authToken: {}
    autoMigrate: true
    dbSecret: {}
    virtualStorages:
      - name: default
        gitalyReplicas: 3
        maxUnavailable: 1
    psql:
      sslMode: 'disable'
    # serviceName:
    service:
      name: praefect
      type: ClusterIP
      externalPort: 8075
      internalPort: 8075
      tls:
        externalPort: 8076
        internalPort: 8076
    tls:
      enabled: false
      # secretName:

  ## https://docs.gitlab.com/charts/charts/globals#configure-minio-settings
  minio:
    enabled: true
    credentials: {}
      # secret:

  ## https://docs.gitlab.com/charts/charts/globals#configure-grafana-integration
  grafana:
    enabled: false

  ## https://docs.gitlab.com/charts/charts/globals#configure-appconfig-settings
  ## Rails based portions of this chart share many settings
  appConfig:
    ## https://docs.gitlab.com/charts/charts/globals#general-application-settings
    enableUsagePing: true
    enableSeatLink: true
    enableImpersonation:
    applicationSettingsCacheSeconds: 60
    defaultCanCreateGroup: false
    usernameChangingEnabled: true
    issueClosingPattern:
    defaultTheme:
    defaultProjectsFeatures:
      issues: true
      mergeRequests: true
      wiki: true
      snippets: true
      builds: true
    webhookTimeout:
    maxRequestDurationSeconds:

    ## https://docs.gitlab.com/charts/charts/globals#cron-jobs-related-settings
    cron_jobs: {}
      ## Flag stuck CI builds as failed
      # stuck_ci_jobs_worker:
      #   cron: "0 * * * *"
      ## Schedule pipelines in the near future
      # pipeline_schedule_worker:
      #   cron: "19 * * * *"
      ## Remove expired build artifacts
      # expire_build_artifacts_worker:
      #   cron: "*/7 * * * *"
      ## Periodically run 'git fsck' on all repositories.
      # repository_check_worker:
      #   cron: "20 * * * *"
      ## Send admin emails once a week
      # admin_email_worker:
      #   cron: "0 0 * * 0"
      ## Remove outdated repository archives
      # repository_archive_cache_worker:
      #   cron: "0 * * * *"
      ## Verify custom GitLab Pages domains
      # pages_domain_verification_cron_worker:
      #   cron: "*/15 * * * *"
      ## Export pseudonymized data
      # pseudonymizer_worker:
      #   cron: "0 * * * *"
      # schedule_migrate_external_diffs_worker:
      #   cron: "15 * * * *"
      ### GitLab Geo
      # Geo Primary only!
      # geo_prune_event_log_worker:
      #   cron: "*/5 * * * *"
      ## GitLab Geo repository sync worker
      # geo_repository_sync_worker:
      #   cron: "*/5 * * * *"
      ## GitLab Geo file download dispatch worker
      # geo_file_download_dispatch_worker:
      #  cron: "*/10 * * * *"
      ## GitLab Geo repository verification primary batch worker
      # geo_repository_verification_primary_batch_worker:
      #   cron: "*/5 * * * *"
      ## GitLab Geo repository verification secondary scheduler worker
      # geo_repository_verification_secondary_scheduler_worker:
      #   cron: "*/5 * * * *"
      ## GitLab Geo migrated local files clean up worker
      # geo_migrated_local_files_clean_up_worker:
      #   cron: "15 */6 * * *"
      ### LDAP
      # ldap_sync_worker:
      #   cron: "30 1 * * *"
      # ldap_group_sync_worker:
      #   cron: "0 * * * *"
      ### Snapshot active user statistics
      # historical_data_worker:
      #   cron: "0 12 * * *"

    ## https://docs.gitlab.com/charts/charts/globals#content-security-policy
    contentSecurityPolicy:
      enabled: false
      report_only: true
      # directives: {}

    ## https://docs.gitlab.com/charts/charts/globals#gravatarlibravatar-settings
    gravatar:
      plainUrl:
      sslUrl:

    ## https://docs.gitlab.com/charts/charts/globals#hooking-analytics-services-to-the-gitlab-instance
    extra:
      googleAnalyticsId:
      matomoUrl:
      matomoSiteId:
      matomoDisableCookies:

    ## https://docs.gitlab.com/charts/charts/globals#lfs-artifacts-uploads-packages-external-mr-diffs
    object_store:
      enabled: false
      proxy_download: true
      storage_options: {}
        # server_side_encryption:
        # server_side_encryption_kms_key_id
      connection: {}
        # secret:
        # key:
    lfs:
      enabled: true
      proxy_download: true
      bucket: git-lfs
      connection: {}
        # secret:
        # key:
    artifacts:
      enabled: true
      proxy_download: true
      bucket: gitlab-artifacts
      connection: {}
        # secret:
        # key:
    uploads:
      enabled: true
      proxy_download: true
      bucket: gitlab-uploads
      connection: {}
        # secret:
        # key:
    packages:
      enabled: true
      proxy_download: true
      bucket: gitlab-packages
      connection: {}
    externalDiffs:
      enabled: false
      when:
      proxy_download: true
      bucket: gitlab-mr-diffs
      connection: {}
    terraformState:
      enabled: false
      bucket: gitlab-terraform-state
      connection: {}
    dependencyProxy:
      enabled: false
      proxy_download: true
      bucket: gitlab-dependency-proxy
      connection: {}

    ## https://docs.gitlab.com/charts/charts/globals#pseudonymizer-settings
    pseudonymizer:
      configMap:
      bucket: gitlab-pseudo
      connection: {}
        # secret:
        # key:
    backups:
      bucket: gitlab-backups
      tmpBucket: tmp

    ## https://docs.gitlab.com/charts/charts/globals#incoming-email-settings
    ## https://docs.gitlab.com/charts/installation/deployment#incoming-email
    incomingEmail:
      enabled: false
      address: ""
      host: "imap.gmail.com"
      port: 993
      ssl: true
      startTls: false
      user: ""
      password:
        secret: ""
        key: password
      expungeDeleted: false
      logger:
        logPath: "/dev/stdout"
      mailbox: inbox
      idleTimeout: 60
      inboxMethod: "imap"
      clientSecret:
        key: secret
      pollInterval: 60

    ## https://docs.gitlab.com/charts/charts/globals#service-desk-email-settings
    ## https://docs.gitlab.com/charts/installation/deployment#service-desk-email
    serviceDeskEmail:
      enabled: false
      address: ""
      host: "imap.gmail.com"
      port: 993
      ssl: true
      startTls: false
      user: ""
      password:
        secret: ""
        key: password
      expungeDeleted: false
      logger:
        logPath: "/dev/stdout"
      mailbox: inbox
      idleTimeout: 60
      inboxMethod: "imap"
      clientSecret:
        key: secret
      pollInterval: 60

    ## https://docs.gitlab.com/charts/charts/globals#ldap
    ldap:
      # prevent the use of LDAP for sign-in via web.
      preventSignin: false
      servers: {}
      ## 'main' is the GitLab 'provider ID' of this LDAP server
      # main:
      #   label: 'LDAP'
      #   host: '_your_ldap_server'
      #   port: 636
      #   uid: 'sAMAccountName'
      #   bind_dn: '_the_full_dn_of_the_user_you_will_bind_with'
      #   password:
      #     secret: _the_secret_containing_your_ldap_password
      #     key: _the_key_which_holds_your_ldap_password
      #   encryption: 'plain'

    ## https://docs.gitlab.com/charts/charts/globals#kas
    gitlab_kas: {}
      # secret:
      # key:
      # enabled:
      # externalUrl:
      # internalUrl:

    ## https://docs.gitlab.com/charts/charts/globals#omniauth
    omniauth:
      enabled: false
      autoSignInWithProvider:
      syncProfileFromProvider: []
      syncProfileAttributes: ['email']
      allowSingleSignOn: ['saml']
      blockAutoCreatedUsers: true
      autoLinkLdapUser: false
      autoLinkSamlUser: false
      autoLinkUser: []
      externalProviders: []
      allowBypassTwoFactor: []
      providers: []
      # - secret: gitlab-google-oauth2
      #   key: provider
    ## https://docs.gitlab.com/charts/charts/globals#configure-appconfig-settings
    sentry:
      enabled: false
      dsn:
      clientside_dsn:
      environment:

    smartcard:
      enabled: false
      CASecret:
      clientCertificateRequiredHost:
      sanExtensions: false
      requiredForGitAccess: false

    sidekiq:
      routingRules: []

    # Config that only applies to the defaults on initial install
    initialDefaults: {}
      # signupEnabled:
  ## End of global.appConfig

  oauth:
    gitlab-pages: {}
      # secret:
      # appIdKey:
      # appSecretKey:
      # redirectUri:

  ## https://docs.gitlab.com/charts/advanced/geo/
  geo:
    enabled: false
    # Valid values: primary, secondary
    role: primary
    ## Geo Secondary only
    # nodeName allows multiple instances behind a load balancer.
    nodeName: # defaults to `gitlab.gitlab.host`
    # PostgreSQL connection details only needed for `secondary`
    psql:
      password: {}
        # secret:
        # key:
      # host: postgresql.hostedsomewhere.else
      # port: 123
      # username: gitlab_replicator
      # database: gitlabhq_geo_production
      # ssl:
        # secret:
        # clientKey:
        # clientCertificate:
        # serverCA:
    registry:
      syncEnabled: false
      ## Consumes global.registry.notificationSecret

  ## https://docs.gitlab.com/charts/charts/gitlab/kas/
  kas:
    enabled: false

  ## https://docs.gitlab.com/charts/charts/globals#configure-gitlab-shell-settings
  shell:
    authToken: {}
      # secret:
      # key:
    hostKeys: {}
      # secret:
    ## https://docs.gitlab.com/charts/charts/globals#tcp-proxy-protocol
    tcp:
      proxyProtocol: false

  ## Rails application secrets
  ## Secret created according to https://docs.gitlab.com/charts/installation/secrets#gitlab-rails-secret
  ## If allowing shared-secrets generation, this is OPTIONAL.
  railsSecrets: {}
    # secret:

  ## Rails generic setting, applicable to all Rails-based containers
  rails:
    bootsnap: # Enable / disable Shopify/Bootsnap cache
      enabled: true

  ## https://docs.gitlab.com/charts/charts/globals#configure-registry-settings
  registry:
    bucket: registry
    certificate: {}
      # secret:
    httpSecret: {}
      # secret:
      # key:
    notificationSecret: {}
      # secret:
      # key:
    # https://docs.docker.com/registry/notifications/#configuration
    notifications: {}
      # endpoints:
      #   - name: FooListener
      #     url: https://foolistener.com/event
      #     timeout: 500ms
      #     threshold: 10
      #     backoff: 1s
      #     headers:
      #       FooBar: ['1', '2']
      #       Authorization:
      #         secret: gitlab-registry-authorization-header
      #       SpecificPassword:
      #         secret: gitlab-registry-specific-password
      #         key: password
      # events: {}

  pages:
    enabled: false
    accessControl: false
    path:
    host:
    port:
    https: # default true
    externalHttp: []
    externalHttps: []
    artifactsServer: true
    objectStore:
      enabled: true
      bucket: gitlab-pages
      # proxy_download: true
      connection: {}
        # secret:
        # key:
    apiSecret: {}
      # secret:
      # key:
    authSecret: {}
      # secret:
      # key:

  ## GitLab Runner
  ## Secret created according to https://docs.gitlab.com/charts/installation/secrets#gitlab-runner-secret
  ## If allowing shared-secrets generation, this is OPTIONAL.
  runner:
    registrationToken: {}
      # secret:

  ## https://docs.gitlab.com/charts/installation/deployment#outgoing-email
  ## Outgoing email server settings
  smtp:
    enabled: false
    address: smtp.mailgun.org
    port: 2525
    user_name: ""
    ## https://docs.gitlab.com/charts/installation/secrets#smtp-password
    password:
      secret: ""
      key: password
    # domain:
    authentication: "plain"
    starttls_auto: false
    openssl_verify_mode: "peer"
    pool: false

  ## https://docs.gitlab.com/charts/installation/deployment#outgoing-email
  ## Email persona used in email sent by GitLab
  email:
    from: ''
    display_name: GitLab
    reply_to: ''
    subject_suffix: ''
    smime:
      enabled: false
      secretName: ""
      keyName: "tls.key"
      certName: "tls.crt"

  ## Timezone for containers.
  time_zone: UTC

  ## Global Service Annotations and Labels
  service:
    labels: {}
    annotations: {}

  ## Global Deployment Annotations
  deployment:
    annotations: {}

  antiAffinity: soft

  ## https://docs.gitlab.com/charts/charts/globals#workhorse
  ## Global settings related to Workhorse
  workhorse:
    serviceName: webservice-default
    # scheme:
    # host:
    # port:
    ## https://docs.gitlab.com/charts/installation/secrets#gitlab-workhorse-secret
    # secret:
    # key:

  ## https://docs.gitlab.com/charts/charts/globals#configure-webservice
  webservice:
    workerTimeout: 60

  ## https://docs.gitlab.com/charts/charts/globals#custom-certificate-authorities
  # configuration of certificates container & custom CA injection
  certificates:
    image:
      repository: registry1.dso.mil/ironbank/gitlab/gitlab/alpine-certificates
      tag: 13.12.9
      pullSecrets:
      - name: private-registry
    customCAs:
      # DoD approved certificates from https://public.cyber.mil/unclass-dod_approved_external_pkis_trust_chains_v7/
      - secret: ca-certs-dod-trust-anchors
      - secret: ca-certs-dod-intermediate-dod-email-ca
      - secret: ca-certs-dod-intermediate-dod-id-ca
      - secret: ca-certs-dod-intermediate-dod-id-sw-ca
      - secret: ca-certs-dod-intermediate-dod-sw-ca
      - secret: ca-certs-eca-sha-1
      - secret: ca-certs-eca-sha-256
      - secret: ca-certs-ado-sha-256-cc-chain
      - secret: ca-certs-ado-sha-256-dt-chain
      - secret: ca-certs-boeing-sha-1
      - secret: ca-certs-carillon-federal-services
      - secret: ca-certs-department-of-state-trust-chain-1
      - secret: ca-certs-department-of-state-trust-chain-2
      - secret: ca-certs-entrust-nfi-trust-chain-1
      - secret: ca-certs-entrust-nfi-trust-chain-2
      - secret: ca-certs-entrust-ssp
      - secret: ca-certs-exostar-llc
      - secret: ca-certs-identrust-nfi
      - secret: ca-certs-lockheed-martin-sha-256
      - secret: ca-certs-nl-mod
      - secret: ca-certs-northrop-grumman-sha-256
      - secret: ca-certs-orc-nfi
      - secret: ca-certs-orc-ssp
      - secret: ca-certs-raytheon-sha-1
      - secret: ca-certs-raytheon-sha-256
      - secret: ca-certs-symantec-nfi-trust-chain-1
      - secret: ca-certs-symantec-nfi-trust-chain-2
      - secret: ca-certs-symantec-ssp-trust-chain-1
      - secret: ca-certs-symantec-ssp-trust-chain-2
      - secret: ca-certs-treasury-ssp-trust-chain-1
      - secret: ca-certs-treasury-ssp-trust-chain-2
      - secret: ca-certs-verizon-business-nfi
      - secret: ca-certs-verizon-business-ssp-trust-chain-1
      - secret: ca-certs-verizon-business-ssp-trust-chain-2

  ## kubectl image used by hooks to carry out specific jobs
  kubectl:
    image:
      repository: registry1.dso.mil/ironbank/gitlab/gitlab/kubectl
      tag: 13.12.9
      pullSecrets:
      - name: private-registry
    securityContext:
      # in most base images, this is `nobody:nogroup`
      runAsUser: 65534
      fsGroup: 65534
  busybox:
    image:
      # repository: busybox
      # tag: latest
      # Busybox can not be hardened with no STIGS. Replacing with UBI-8 container
      repository: registry1.dso.mil/ironbank/redhat/ubi/ubi8
      tag: "8.4"
      pullSecrets:
      - name: private-registry

  ## https://docs.gitlab.com/charts/charts/globals#service-accounts
  serviceAccount:
    enabled: false
    create: true
    annotations: {}
    ## Name to be used for serviceAccount, otherwise defaults to chart fullname
    # name:

  ## https://docs.gitlab.com/charts/charts/globals/tracing#tracing
  tracing:
    connection:
      string: ""
    urlTemplate: ""

  ## https://docs.gitlab.com/charts/charts/globals
  extraEnv: {}
   # SOME_KEY: some_value
   # SOME_OTHER_KEY: some_other_value

  ## https://docs.gitlab.com/charts/charts/globals
  platform:
    eksRoleArn:

## End of global

upgradeCheck:
  enabled: true
  image:
    repository: registry1.dso.mil/ironbank/redhat/ubi/ubi8
    tag: "8.4"
    pullSecrets:
    - name: private-registry
  securityContext:
    # in alpine/debian/busybox based images, this is `nobody:nogroup`
    runAsUser: 65534
    fsGroup: 65534
  tolerations: []
  resources:
    requests:
      cpu: 500m
      memory: 500Mi
    limits:
      cpu: 500m
      memory: 500Mi

## Settings to for the Let's Encrypt ACME Issuer
# certmanager-issuer:
#   # The email address to register certificates requested from Let's Encrypt.
#   # Required if using Let's Encrypt.
#   email: email@example.com

## Installation & configuration of jetstack/cert-manager
## See requirements.yaml for current version
certmanager:
  createCustomResource: false
  nameOverride: cert-manager
  # Install cert-manager chart. Set to false if you already have cert-manager
  # installed or if you are not using cert-manager.
  install: false
  # Other cert-manager configurations from upstream
  # See https://github.com/jetstack/cert-manager/blob/master/deploy/charts/cert-manager/README#configuration
  rbac:
    create: true
  webhook:
    enabled: false

## https://docs.gitlab.com/charts/charts/nginx/
## https://docs.gitlab.com/charts/architecture/decisions#nginx-ingress
## Installation & configuration of charts/ingress-nginx:
nginx-ingress:
  enabled: false
  tcpExternalConfig: "true"
  controller:
    addHeaders:
      Referrer-Policy: strict-origin-when-cross-origin
    config:
      hsts: "false"
      hsts-include-subdomains: "false"
      server-name-hash-bucket-size: "256"
      use-http2: "true"
      ssl-ciphers: "ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES256-SHA384:ECDHE-RSA-AES128-SHA256:ECDHE-RSA-AES256-SHA:ECDHE-RSA-AES128-SHA:AES256-GCM-SHA384:AES128-GCM-SHA256:AES256-SHA256:AES128-SHA256:AES256-SHA:AES128-SHA:!aNULL:!eNULL:!EXPORT:!DES:!MD5:!PSK:!RC4"
      ssl-protocols: "TLSv1.3 TLSv1.2"
      server-tokens: "false"
    service:
      externalTrafficPolicy: "Local"
    resources:
      requests:
        cpu: 100m
        memory: 100Mi
    publishService:
      enabled: true
    replicaCount: 2
    minAvailable: 1
    scope:
      enabled: true
    metrics:
      enabled: true
      service:
        annotations:
          gitlab.com/prometheus_scrape: "true"
          gitlab.com/prometheus_port: "10254"
          prometheus.io/scrape: "true"
          prometheus.io/port: "10254"
    admissionWebhooks:
      enabled: false
  defaultBackend:
    enabled: true
    minAvailable: 1
    replicaCount: 1
    resources:
      requests:
        cpu: 5m
        memory: 5Mi
  rbac:
    create: true
    scope: true
  serviceAccount:
    create: true

## Installation & configuration of stable/prometheus
## See requirements.yaml for current version
prometheus:
  install: false
  rbac:
    create: true
  alertmanager:
    enabled: false
  alertmanagerFiles:
    alertmanager.yml: {}
  kubeStateMetrics:
    enabled: false
  nodeExporter:
    enabled: false
  pushgateway:
    enabled: false
  server:
    enabled: false
    retention: 15d
    strategy:
      type: Recreate
  #
  serverFiles:
    prometheus.yml:
      scrape_configs:
        - job_name: prometheus
          static_configs:
            - targets:
              - localhost:9090
        - job_name: 'kubernetes-apiservers'
          kubernetes_sd_configs:
            - role: endpoints
          scheme: https
          tls_config:
            ca_file: /var/run/secrets/kubernetes.io/serviceaccount/ca.crt
            insecure_skip_verify: true
          bearer_token_file: /var/run/secrets/kubernetes.io/serviceaccount/token
          relabel_configs:
            - source_labels: [__meta_kubernetes_namespace, __meta_kubernetes_service_name, __meta_kubernetes_endpoint_port_name]
              action: keep
              regex: default;kubernetes;https
        - job_name: 'kubernetes-pods'
          kubernetes_sd_configs:
            - role: pod
          relabel_configs:
            - source_labels: [__meta_kubernetes_pod_annotation_gitlab_com_prometheus_scrape]
              action: keep
              regex: true
            - source_labels: [__meta_kubernetes_pod_annotation_gitlab_com_prometheus_path]
              action: replace
              target_label: __metrics_path__
              regex: (.+)
            - source_labels: [__address__, __meta_kubernetes_pod_annotation_gitlab_com_prometheus_port]
              action: replace
              regex: ([^:]+)(?::\d+)?;(\d+)
              replacement: $1:$2
              target_label: __address__
            - action: labelmap
              regex: __meta_kubernetes_pod_label_(.+)
            - source_labels: [__meta_kubernetes_namespace]
              action: replace
              target_label: kubernetes_namespace
            - source_labels: [__meta_kubernetes_pod_name]
              action: replace
              target_label: kubernetes_pod_name
        - job_name: 'kubernetes-service-endpoints'
          kubernetes_sd_configs:
            - role: endpoints
          relabel_configs:
            - action: keep
              regex: true
              source_labels:
                - __meta_kubernetes_service_annotation_gitlab_com_prometheus_scrape
            - action: replace
              regex: (https?)
              source_labels:
                - __meta_kubernetes_service_annotation_gitlab_com_prometheus_scheme
              target_label: __scheme__
            - action: replace
              regex: (.+)
              source_labels:
                - __meta_kubernetes_service_annotation_gitlab_com_prometheus_path
              target_label: __metrics_path__
            - action: replace
              regex: ([^:]+)(?::\d+)?;(\d+)
              replacement: $1:$2
              source_labels:
                - __address__
                - __meta_kubernetes_service_annotation_gitlab_com_prometheus_port
              target_label: __address__
            - action: labelmap
              regex: __meta_kubernetes_service_label_(.+)
            - action: replace
              source_labels:
                - __meta_kubernetes_namespace
              target_label: kubernetes_namespace
            - action: replace
              source_labels:
                - __meta_kubernetes_service_name
              target_label: kubernetes_name
            - action: replace
              source_labels:
                - __meta_kubernetes_pod_node_name
              target_label: kubernetes_node
        - job_name: 'kubernetes-services'
          metrics_path: /probe
          params:
            module: [http_2xx]
          kubernetes_sd_configs:
            - role: service
          relabel_configs:
            - source_labels: [__meta_kubernetes_service_annotation_gitlab_com_prometheus_probe]
              action: keep
              regex: true
            - source_labels: [__address__]
              target_label: __param_target
            - target_label: __address__
              replacement: blackbox
            - source_labels: [__param_target]
              target_label: instance
            - action: labelmap
              regex: __meta_kubernetes_service_label_(.+)
            - source_labels: [__meta_kubernetes_namespace]
              target_label: kubernetes_namespace
            - source_labels: [__meta_kubernetes_service_name]
              target_label: kubernetes_name

## Configuration of Redis
## https://docs.gitlab.com/charts/architecture/decisions#redis
## https://docs.gitlab.com/charts/installation/deployment.html#redis
redis:
  install: true
  existingSecret: gitlab-redis-secret
  existingSecretKey: redis-password
  usePasswordFile: true
  cluster:
    enabled: false
  metrics:
    enabled: true
    image:
      registry: registry1.dso.mil/ironbank/bitnami
      repository: analytics/redis-exporter
      tag: 1.18.0
      pullSecrets:
      - private-registry
    resources:
      limits: 
        cpu: 250m
        memory: 256Mi
      requests: 
        cpu: 250m
        memory: 256Mi
  image:
    registry: registry1.dso.mil/ironbank/opensource
    repository: redis/redis5
    tag: 5.0.9
    pullSecrets:
    - private-registry
  master:
    command: "redis-server"
    resources: 
      limits: 
        cpu: 250m
        memory: 256Mi
      requests: 
        cpu: 250m
        memory: 256Mi
  slave:
    command: "redis-server"
    resources: 
      limits: 
        cpu: 250m
        memory: 256Mi
      requests: 
        cpu: 250m
        memory: 256Mi
  sentinel:
    resources: 
      limits: 
        cpu: 250m
        memory: 256Mi
      requests: 
        cpu: 250m
        memory: 256Mi
  volumePermissions:
    resources: 
      limits: 
        cpu: 250m
        memory: 256Mi
      requests: 
        cpu: 250m
        memory: 256Mi
  sysctlImage:
    resources: 
      limits: 
        cpu: 250m
        memory: 256Mi
      requests: 
        cpu: 250m
        memory: 256Mi

## Installation & configuration of stable/prostgresql
## See requirements.yaml for current version
postgresql:
  postgresqlUsername: gitlab
  # This just needs to be set. It will use a second entry in existingSecret for postgresql-postgres-password
  postgresqlPostgresPassword: bogus
  install: true
  postgresqlDatabase: gitlabhq_production
  resources:
    limits:
      cpu: 500m
      memory: 500Mi
    requests:
      cpu: 500m
      memory: 500Mi
  image:
    ## could not get IronBank hardened image to work with the bitnami postgres sub-chart
    registry: registry.dso.mil
    repository: platform-one/big-bang/apps/developer-tools/gitlab/postgresql
    tag: 11.9.0
  usePasswordFile: true
  existingSecret: 'bogus'
  initdbScriptsConfigMap: 'bogus'
  master:
    extraVolumeMounts:
      - name: custom-init-scripts
        mountPath: /docker-entrypoint-preinitdb.d/init_revision.sh
        subPath: init_revision.sh
    podAnnotations:
      postgresql.gitlab/init-revision: "1"
  metrics:
    enabled: false
    ## Optionally define additional custom metrics
    ## ref: https://github.com/wrouesnel/postgres_exporter#adding-new-metrics-via-a-config-file

## Installation & configuration charts/registry
## https://docs.gitlab.com/charts/architecture/decisions#registry
## https://docs.gitlab.com/charts/charts/registry/
registry:
  enabled: true
  init:
    resources:
      limits:
        cpu: 200m
        memory: 200Mi
      requests:
        cpu: 200m
        memory: 200Mi
  resources:
    limits:
      cpu: 200m
      memory: 1024Mi
    requests:
      cpu: 200m
      memory: 1024Mi
  image:
    repository: registry1.dso.mil/ironbank/gitlab/gitlab/gitlab-container-registry
    tag: 13.12.9
    pullSecrets:
    - name: private-registry
  ingress:
    enabled: false # Local setting in subchart must be overridden


## Automatic shared secret generation
## https://docs.gitlab.com/charts/installation/secrets
## https://docs.gitlab.com/charts/charts/shared-secrets
shared-secrets:
  enabled: true
  rbac:
    create: true
  selfsign:
    image:
      repository: registry1.dso.mil/ironbank/gitlab/gitlab/cfssl-self-sign
      tag: 1.4.1
      pullSecrets:
      - name: private-registry
    keyAlgorithm: "rsa"
    keySize: "4096"
    expiry: "365d"
    caSubject: "GitLab Helm Chart"
    pullSecrets: []
  env: production
  serviceAccount:
    create: true
    name: # Specify a pre-existing ServiceAccount name
  resources:
    requests:
      cpu: 300m
      memory: 200Mi
    limits:
      cpu: 300m
      memory: 200Mi
  securityContext:
    # in debian/alpine based images, this is `nobody:nogroup`
    runAsUser: 65534
    fsGroup: 65534
  tolerations: []
  podLabels: {}
  annotations: {}

## Installation & configuration of gitlab/gitlab-runner
## See requirements.yaml for current version
gitlab-runner:
  install: false
  rbac:
    create: true
  runners:
    locked: false
    config: |
      [[runners]]
        [runners.kubernetes]
        image = "ubuntu:18.04"
        {{- if .Values.global.minio.enabled }}
        [runners.cache]
          Type = "s3"
          Path = "gitlab-runner"
          Shared = true
          [runners.cache.s3]
            ServerAddress = {{ include "gitlab-runner.cache-tpl.s3ServerAddress" . }}
            BucketName = "runner-cache"
            BucketLocation = "us-east-1"
            Insecure = false
        {{ end }}
  podAnnotations:
    gitlab.com/prometheus_scrape: "true"
    gitlab.com/prometheus_port: 9252

## Installation & configuration of stable/grafana
## See requirements.yaml for current version
## Controlled by `global.grafana.enabled`
grafana:
  ## Override and provide "bogus" administation secrets
  ## gitlab/gitlab-grafana provides overrides via shared-secrets
  admin:
    existingSecret: bogus
  env:
    GF_SECURITY_ADMIN_USER: bogus
    GF_SECURITY_ADMIN_PASSWORD: bogus
  ## This override allows gitlab/gitlab-grafana to completely override the secret
  ##   handling behavior of the upstream chart in combination with the above.
  command: [ "sh", "-x", "/tmp/scripts/import-secret.sh" ]
  ## The following settings allow Grafana to dynamically create
  ## dashboards and datasources from configmaps. See
  ## https://artifacthub.io/packages/helm/grafana/grafana#sidecar-for-dashboards
  sidecar:
    dashboards:
      enabled: true
      label: gitlab_grafana_dashboard
    datasources:
      enabled: true
      label: gitlab_grafana_datasource
  ## We host Grafana as a sub-url of GitLab
  grafana.ini:
    server:
      serve_from_sub_path: true
      root_url: http://localhost/-/grafana/
  ## We generate and provide random passwords
  ## NOTE: the Secret & ConfigMap names are hard coded!
  extraSecretMounts:
    - name: initial-password
      mountPath: /tmp/initial
      readOnly: true
      secretName: gitlab-grafana-initial-password
      defaultMode: 400
  extraConfigmapMounts:
    - name: import-secret
      mountPath: /tmp/scripts
      configMap: gitlab-grafana-import-secret
      readOnly: true
  testFramework:
    enabled: false

## Settings for individual sub-charts under GitLab
## Note: Many of these settings are configurable via globals
gitlab:
  ## https://docs.gitlab.com/charts/charts/gitlab/task-runner
  task-runner:
    replicas: 1
    antiAffinityLabels:
      matchLabels:
        app: 'gitaly'
    image:
      repository: registry1.dso.mil/ironbank/gitlab/gitlab/gitlab-task-runner
      tag: 13.12.9
      pullSecrets:
      - name: private-registry
    init:
      resources:
        requests:
          cpu: 200m
          memory: 200Mi
        limits:
          cpu: 200m
          memory: 200Mi
    resources:
      requests:
        cpu: 2
        memory: 3.5Gi
      limits:
        cpu: 2
        memory: 3.5Gi
    backups:
      cron:
        resources:
          requests:
            cpu: 350m
            memory: 350Mi
          limits:
            cpu: 350m
            memory: 350Mi

  gitlab-exporter:
    enabled: false
    init:
      resources:
        limits:
          cpu: 200m
          memory: 200Mi
        requests:
          cpu: 200m
          memory: 200Mi
    resources:
      limits:
        cpu: 150m
        memory: 200Mi
      requests:
        cpu: 150m
        memory: 200Mi
    image:
      repository: registry1.dso.mil/ironbank/gitlab/gitlab/gitlab-exporter
      tag: 13.12.9
      pullSecrets:
      - name: private-registry
    metrics:
      enabled: true
      port: 9168
## https://docs.gitlab.com/charts/charts/gitlab/migrations
  migrations:
    init:
      resources:
        limits:
          cpu: 200m
          memory: 200Mi
        requests:
          cpu: 200m
          memory: 200Mi
    resources:
      limits:
        cpu: 500m
        memory: 1G
      requests:
        cpu: 500m
        memory: 1G
    image:
      repository: registry1.dso.mil/ironbank/gitlab/gitlab/gitlab-task-runner
      tag: 13.12.9
      pullSecrets:
      - name: private-registry
## https://docs.gitlab.com/charts/charts/gitlab/webservice
  webservice:
    init:
      resources:
        # https://docs.gitlab.com/charts/charts/gitlab/webservice/index.html#memory-requestslimits
        limits:
          cpu: 200m
          memory: 200Mi
        requests:
          cpu: 200m
          memory: 200Mi
    resources:
      # https://docs.gitlab.com/charts/charts/gitlab/webservice/index.html#memory-requestslimits
      limits:
        cpu: 600m # double the default
        memory: 2.5G # = 2 * 1.25G assuming there are 2 workerProcesses configured
      requests:
        cpu: 600m # double the default
        memory: 2.5G # = 2 * 1.25G assuming there are 2 workerProcesses configured
    image:
      repository: registry1.dso.mil/ironbank/gitlab/gitlab/gitlab-webservice
      tag: 13.12.9
      pullSecrets:
      - name: private-registry
    workhorse:
      resources:
        # https://docs.gitlab.com/charts/charts/gitlab/webservice/index.html#memory-requestslimits
        limits:
          cpu: 600m
          memory: 2.5G
        requests:
          cpu: 600m
          memory: 2.5G
      image: registry1.dso.mil/ironbank/gitlab/gitlab/gitlab-workhorse
      tag: 13.12.9
      pullSecrets:
      - name: private-registry
    ingress:
      enabled: false  # Local setting in subchart must be overridden
## https://docs.gitlab.com/charts/charts/gitlab/sidekiq
  sidekiq:
    image:
      repository: registry1.dso.mil/ironbank/gitlab/gitlab/gitlab-sidekiq
      tag: 13.12.9
      pullSecrets:
      - name: private-registry
    init:
      resources:
        limits:
          cpu: 200m
          memory: 200Mi
        requests:
          cpu: 200m
          memory: 200Mi
    resources:
      requests:
        memory: 3G
        cpu: 1500m
      limits:
        memory: 3G
        cpu: 1500m

## https://docs.gitlab.com/charts/charts/gitlab/gitaly
  gitaly:
    image:
      repository: registry1.dso.mil/ironbank/gitlab/gitlab/gitaly
      tag: 13.12.9
      pullSecrets:
      - name: private-registry
    init:
      resources:
        limits:
          cpu: 200m
          memory: 200Mi
        requests:
          cpu: 200m
          memory: 200Mi
    resources:
      requests:
        cpu: 200m
        memory: 300Mi
      limits:
        cpu: 200m
        memory: 300Mi
## https://docs.gitlab.com/charts/charts/gitlab/gitlab-shell
  gitlab-shell:
    image:
      repository: registry1.dso.mil/ironbank/gitlab/gitlab/gitlab-shell
      tag: 13.12.9
      pullSecrets:
      - name: private-registry
    init:
      resources:
        limits:
          cpu: 200m
          memory: 200Mi
        requests:
          cpu: 200m
          memory: 200Mi
    resources:
      limits:
        cpu: 300m
        memory: 300Mi
      requests:
        cpu: 300m
        memory: 300Mi

## doc/charts/gitlab/praefect  # added by BigBang
  praefect:
    image:
      repository: registry1.dso.mil/ironbank/gitlab/gitlab/gitaly
      tag: 13.12.9
    init:
      resources:
        limits:
          cpu: 200m
          memory: 200Mi
        requests:
          cpu: 200m
          memory: 200Mi
    resources:
      requests:
        cpu: 1
        memory: 1Gi
      limits:
        cpu: 1
        memory: 1Gi

## https://docs.gitlab.com/charts/charts/gitlab/gitlab-grafana
#   gitlab-grafana:

## Override minio sub-chart values
minio:
  # set resource QoS
  init:
    resources:
      limits:
        cpu: 200m
        memory: 200Mi
      requests:
        cpu: 200m
        memory: 200Mi
  resources:
    limits:
      cpu: 200m
      memory: 300Mi
    requests:
      cpu: 200m
      memory: 300Mi
  # use Ironbank hardened images for MinIO
  image: registry1.dso.mil/ironbank/opensource/minio/minio
  imageTag: RELEASE.2021-04-06T23-11-00Z
  pullSecrets:
  - name: private-registry
  minioMc:
    # the MinIO sub-chart config script was modified to work with newer mc version in IronBank image
    #   chart/charts/minio/templates/_helper_create_buckets.sh
    #       line 65
    #        /usr/bin/mc policy set $POLICY myminio/$BUCKET
    image: registry1.dso.mil/ironbank/opensource/minio/mc
    tag: RELEASE.2021-03-23T05-46-11Z
    pullSecrets:
    - name: private-registry

# Big Bang Additions
hostname: bigbang.dev
istio:
  # Toggle istio integration
  enabled: false
  gitlab:
    # Toggle vs creation
    enabled: true
    annotations: {}
    labels: {}
    gateways:
      - istio-system/main
    # optional - only affects the Istio VirtualService ingress. Does not affect Gitlab configuration
    hosts: null
  registry:
    # Toggle vs creation
    enabled: true
    annotations: {}
    labels: {}
    gateways:
      - istio-system/main
    # optional - only affects the Istio VirtualService ingress. Does not affect Gitlab configuration
    hosts: null

monitoring:
  enabled: false

networkPolicies:
  enabled: false
  ingressLabels:
    app: istio-ingressgateway
    istio: ingressgateway
  # See `kubectl cluster-info` and then resolve to IP
  controlPlaneCidr: 0.0.0.0/0

openshift: false